Malware Analysis Report

2025-01-22 23:11

Sample ID 241128-kk9s1axqhp
Target 2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe
SHA256 2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da
Tags
banload discovery downloader dropper evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da

Threat Level: Known bad

The file 2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion spyware stealer trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks BIOS information in registry

Checks computer location settings

Checks installed software on the system

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

NSIS installer

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Checks processor information in registry

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-28 08:40

Signatures

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-28 08:40

Reported

2024-11-28 08:42

Platform

win7-20241010-en

Max time kernel

109s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\GMInstaller\iWinLauncher.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
File created C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\iWinLauncher.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\ C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
File created C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\iWinArcade C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\iWinArcade\installRoot = "c:\\games\\Iplay Games" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qTzjcR = "IFL\x7funTYrvIiKQA^a\\_xhNo@v" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eeojqvrwyiX = "\\Gefm]aRQi\\]qh}XE^@~D@O{^U" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\qTzjcR = "EEQSJdv~]`eG}b}}\\uQG}QZpa" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\InprocServer32\ThreadingModel = "Apartment" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\VersionIndependentProgID \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ilgclcxfpfa = "JiIckqQ^azzOIv|pQ]DO~EhTQhs`vK" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\KJgalMBbwqQvK = "n@SXEFwgdZ@\x7f_y\\JsueYtKE" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\eeojqvrwyiX = "o~]]t^]`pl_\x7fWUf\\}Lc{GACEUd" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qTzjcR = "IFL\x7funTYrvIiKQA^a\\_}hNo@v" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "veefVl" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\syBwadlR = "r^_UwaxhiO`[}cuAjuIFQ^XD" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\IplayArcade C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\YahooArcade C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\Mundus: Impossible Universe\InstallDir = "c:\\games\\Iplay Games\\Mundus Impossible Universe" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\eeojqvrwyiX = "o~]]t^m`pl_\x7fWUf\\}Lc{GACEUd" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "fBMaJh" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\syBwadlR = "MMt\\ircvZkNU]fFevXaq_AMz" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\syBwadlR = "MMt\\ircvZkNU]fFevXaq_AMz" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\7971117617474095322 = "Mundus: Impossible Universe" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\JymmxVdnkzpgi = "`oWKRAPHYgdH]ETV|" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "r]z`VD" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "k[`fJH" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\KJgalMBbwqQvK = "n@SXEFwgdZ@\x7f_y\\JsueYtKE" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eeojqvrwyiX = "\\Gefm]aRQi\\]qh}XE^@~D@O{^U" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D} \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\VersionIndependentProgID\ = "FormHost.FormHost" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "|yjeVx" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\rtkpvkQKlDmdu = "@Xl\x7fluxSUVHeao@kUVxH_TcgCW" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ilgclcxfpfa = "JiIckqQ^azzOIv|pQ]DO~EhTQhs`vK" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\rtkpvkQKlDmdu = "@Xl\x7fluxSUVHeao@kUVxH_TcgCW" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\syBwadlR = "r^_UwaxhiO`[}cuAjuIFQ_xD" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eeojqvrwyiX = "\\Gefm]qRQi\\]qh}XE^@~D@O{^U" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "aXUvBt" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eeojqvrwyiX = "\\Gefm\\QRQi\\]qh}XE^@~D@O{^U" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qawW = "fVmIMGhfVixz`ZgjNM" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "e`JpB\\" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\qTzjcR = "EEQSJdv~]`eG}b}}\\uQK}QZpa" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "}eL~UX" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "h@RKNd" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "wyC}UL" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qTzjcR = "IFL\x7funTYrvIiKQA^a\\_~hNo@v" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ilgclcxfpfa = "JgwnNjvfRmYyEpFNAMEOoNi@grPvbW" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qTzjcR = "IFL\x7funTYrvIiKQA^a\\_zhNo@v" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\rtkpvkQKlDmdu = "@Xl\x7fluxSUVHeao@kUVxH_TcgCW" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\syBwadlR = "MMt\\ircvZkNU]fFevXaq_@mz" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\Mundus: Impossible Universe\GameExe = "GameLauncher.exe" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "q\x7f}q^p" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\qTzjcR = "EEQSJdv~]`eG}b}}\\uQD}QZpa" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ieds = "|fPv^P" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\syBwadlR = "MMt\\ircvZkNU]fFevXaq_A]z" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ProgID\ = "FormHost.FormHost.1" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qTzjcR = "IFL\x7funTYrvIiKQA^a\\_phNo@v" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\qTzjcR = "IFL\x7funTYrvIiKQA^a\\_|hNo@v" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\qTzjcR = "EEQSJdv~]`eG}b}}\\uQB}QZpa" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "mBdyI\\" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "jX|nA@" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\ieds = "mLRg@l" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\ProgID \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\rtkpvkQKlDmdu = "hpvUhE_BI_MLYjj|eR@BiP_iSY" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\JymmxVdnkzpgi = "`oWKRAPHYgdH]ETV|" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2084 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe
PID 2432 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 2432 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 2432 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 2432 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 2720 wrote to memory of 3016 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 2720 wrote to memory of 3016 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 2720 wrote to memory of 3016 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 2720 wrote to memory of 3016 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 3016 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 3016 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2320 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 2320 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 2320 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 2320 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 1856 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe
PID 3016 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 3016 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe

"C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe"

C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nseE081.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest="PF/7971117617474095322/7971117605521780774/13/0"

C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe

"C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe" -gmregchannelid=110341560

C:\Program Files (x86)\GMInstaller\ugm_installer.exe

"C:\Program Files (x86)\GMInstaller\ugm_installer.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest="PF/7971117617474095322/7971117605521780774/13/0"

C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" -config.uri=http://gm/iwin/index.html -config.channel="110341560" -config.iwinrequest="PF/7971117617474095322/7971117605521780774/13/0"

C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe

"C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=renderer --enable-logging --log-level=2 --no-sandbox --user-agent="NextDM/2.16.2.1015 AppleWebKit/535.19 (KHTML, like Gecko) GamesManager/2.16.2.1015 110341560 WinVer/6.1 [x64]" --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" --lang --channel=3016.00E41C80.54373454 /prefetch:3

C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe

"C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=gpu-process --channel=3016.00ED9FA0.1497101592 --enable-logging --log-level=2 --no-sandbox --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" /prefetch:12

C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe

"C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe" -gmregcopysrc="HKEY_LOCAL_MACHINE\Software\iWinArcade" -gmregcopydest="HKEY_CURRENT_USER\Software\IplayArcade" -gmregcopylocalmachinedest="HKEY_LOCAL_MACHINE\Software\IplayArcade" -gmregisiwin=true -gmchannelcode=110341560 -game.sku="7971117617474095322" -game.name="Mundus: Impossible Universe" -gmregcopyvirtual=HKU\S-1-5-21-2039016743-699959520-214465309-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade -gmreg="Software\IplayArcade" -gmexe="IplayGames.exe" -gmregkey="Install_Dir" -installer="C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe" -preinstallurl="http://gm-iplay.iwin.com/dl/preinstall-options.exe" -gamestring=7971117617474095322 -config.installRoot="c:\games\Iplay Games" -gmInstallRootRegKey="HKEY_CURRENT_USER\Software\iWinArcade\installRoot"

C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe

"C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe" -gamestring=7971117617474095322 /S

C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe

"C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe" /S

C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe

"C:\Users\Admin\AppData\Local\Temp\nsjE216.tmp\iWinInstallOptions.exe" /S

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.iwin.com udp
NL 18.239.69.43:80 dl.iwin.com tcp
US 8.8.8.8:53 static.iwincdn.com udp
FR 68.232.35.54:80 static.iwincdn.com tcp
US 8.8.8.8:53 gm-iplay.iwin.com udp
US 54.227.242.142:80 gm-iplay.iwin.com tcp
US 8.8.8.8:53 fea.iwincdn.com udp
FR 68.232.35.54:80 fea.iwincdn.com tcp
US 54.227.242.142:80 gm-iplay.iwin.com tcp
GB 172.217.169.40:80 www.googletagmanager.com tcp
US 8.8.8.8:53 cimg.iwin.com udp
US 8.8.8.8:53 ws-iplay.iwin.com udp
US 52.22.60.172:80 ws-iplay.iwin.com tcp
IE 3.162.140.101:80 cimg.iwin.com tcp
US 8.8.8.8:53 download.iwincdn.com udp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.200.3:80 o.pki.goog tcp
US 54.227.242.142:80 ws-iplay.iwin.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 8.8.8.8:53 dl.iwin.com udp
NL 18.239.69.73:80 dl.iwin.com tcp

Files

\Users\Admin\AppData\Local\Temp\nseE081.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\nseE081.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

\Users\Admin\AppData\Local\Temp\nst8E.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

\Program Files (x86)\GMInstaller\iWinUpgrader.exe

MD5 3d72f38357f46715e675e074d59fc7a9
SHA1 2cf2f0d655fbbff941ae3d5c1e911096fec5bd12
SHA256 86cb79cb393ccbebd65e137cf509f09e0cabaecb93a2d21369488002712af118
SHA512 35f5e1f19490814db7bb041588ed9f6c99a04cdb485c19fbae3e96e59da003c345aa835fe482e904c73577f37eba6f47982dc4ba5d3b5a58396b794830639006

\Users\Admin\AppData\Local\Temp\nst8E.tmp\StdUtils.dll

MD5 c291f96471927e7bc49398b0de7168dd
SHA1 eda478005d69ee86126a8378de5007b139e20a5d
SHA256 c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6
SHA512 b4244615e99617d437d3120f201ca88c7ab4a6b4b84e7f0c3b4495a0fe8c979e04feaa08f11ad14fa92f002a3a521422221132ff54a081ef1c6bcbdf09d5929d

memory/2432-47-0x00000000003F0000-0x00000000003F2000-memory.dmp

\Users\Admin\AppData\Local\Temp\nst193D.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

C:\Users\Admin\AppData\Local\GamesManager\110402287\cdata.dat

MD5 11e4b4414b6271b8f8c45511f97d4e5a
SHA1 65ee25560144d22bf7f8bce3b8742a856a8ee6d1
SHA256 db67ca3cf89a6fccd13aa21207e279c3fd3c7bcaf181c65ecfc18cf2da289eb3
SHA512 68e8bce33cfc588f800f486f51c8a1e27b12e58af336946102d61a451341eee875b4cbb2a4203f3cade174b21f9e74cd82d15988abb107564c87c2e3bd088c58

C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe

MD5 e6fd8ebffb607e1ade009aec7d657fd4
SHA1 9df29bd83f62fcb7c6f3f644692254a698e54f28
SHA256 86007bfeee566f599f1eb496710835ca2975bd710067cc6a095f909828a5580a
SHA512 3d65334200bfbf2eece9e8b98894cd78d3d58c76a45e1d864cc9648c96c57633671a87646e6268c4a14ee846ed2eec4706041e61a80e2657a1d05a7afb6a88e2

memory/3016-921-0x0000000000180000-0x0000000000192000-memory.dmp

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000001

MD5 e2ff9e87912d08576c7f26a8014b2525
SHA1 026136afd27657e7edead2f12310275af249caac
SHA256 5e663896f40416a2d5f159e0433dbc9019dbe9d05abb34c1f3a5b38a88b5c03a
SHA512 7b4dfe37205909f2f14669c965821a91daba8be383ce83d119fde5d290bc938eeaf0c70e9d27998f00dc6cdca0d0c0b1b2bbdc13ac2662fc4e766919e092e1d9

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000002

MD5 ae0a675e3e15e28aab8246028df16236
SHA1 772b2587aa2fa345fb760eff9ebe5acd97937243
SHA256 49f14bad610f40f0ae76a33c55ef89a1e694219bab49b1b99cb53d754774c0fc
SHA512 21723efa6aaa2fa599b42c1480c380c24f9aaf14755e82e88054e80713454408bfb047ba77d921d71573d2319f14f134938f3401aa3b92b756670b7c99892caa

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000003

MD5 a959af924d21c7b788fe197caf03fc40
SHA1 21733827a5501133619b8ac4533201267d1afa3f
SHA256 4d191ea72953f5806161c3c16ae8e4bb629b47156481bd074acfa5db08000016
SHA512 1fa28a7fe716b328fc43b3e8993875977a2e9f39fd02dfce313d27021403ddfaf7f19c7607bf1350c4c2f05a38170d3621ed33cc60f8b38fb9d1dbda63b120e7

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000004

MD5 7fd8ffea25728006bfddf7e6c7c122cd
SHA1 e3049e9f8a643b8b2cfd2ca5e6ab8bfd483efe99
SHA256 0a6c4c4db171663b9b1c533a4dd6938e22cb4d5b9607d0ca92a20c1354018b49
SHA512 477467568f8c24772fd83680db1e9750c7e377cb706c0fa734e9c8b1bc847cf9a60f4be444044bdbfa4cdb9cb4352f86edd1ea70bdcd86a20b361f9acb2cd58f

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000005

MD5 8c81fab58b8ed37b527b16a37a8065c3
SHA1 5d3d58f8833d9975d6dd5e7153b22a936f2f76bd
SHA256 74d4acb9d62968980f8a096977e3bf42c1ccffb0c7501a7fff1a0ba589b56bd7
SHA512 e99c9eae7718c4154bc2895431261e1ac3cafda565d85474876be004063742d84af1c20f970dd1f30c9c5acbb00d3e7357f7a13376730cbd987a24dcc4086699

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000006

MD5 032f7a630c11189923cae95fb0fa6892
SHA1 74dddaa937b077fb98b584b20e1a3e3ad1bee422
SHA256 b0b84f6aca649b3b9131799ed0983e03b113497df4f33e30a3389ee1b34687ee
SHA512 e24c5a9dfd1f6fcd07dea0b3723a0794fe27042c2f52d0b869e8224ed0a442e73e24d265103ba2f11783b8c408f9724ba11ef76a1e3330ee3b78156ebad406bf

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000007

MD5 962bf963a37a6d84fe7fb552763dc094
SHA1 cac681467dac917122dd9b57bd9a78781549a523
SHA256 2f49797d196f00bb331663ac1564c775d65ed1bfb508aec9e4c3b6fc89bb4dc0
SHA512 e378da6a0d29f91eb5a0de3876fda0cc1b5a6e6632f5ddf0d45fcc909084aad70bd99b97a29df15d271593701bd77a92766a1f091540dc3cdf699c9d831b6192

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000008

MD5 5cc4154e0c0dac8dfeea73c07ccdc83e
SHA1 5d2d995d51b8855d1e1e43b85d8b5a9d22b796ad
SHA256 12d5f1be9a764164f4cc6e7dda726c4ea3d19ea79382d28c75b0dea862608968
SHA512 1112959cfecc25efae799b566dff24f7bfafc60ddd8974ce0cdd653ee834a57090d9f78e2773ad9a826e0ba6e1487c49e1ef957c34385c262914f09ea8b26157

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000009

MD5 b41c0b75a60eab42145e9d0b17408b0b
SHA1 0f3151c6c22834079b55fcea9d873c0184b3fd7c
SHA256 209dc679252feca2725cafb6e8fc314f2618bd748db846be6b4e0ca71c55a330
SHA512 f728be6cb869a6279a6ba1d85865c510c6f9905a04226a25965b7b5eb0feadbaf4364f4508b08292eb597b2a9fe14af4e6fa8a9eb56f4e704108dc09e862edbe

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000a

MD5 4e5d5ff08a7703b746695ec19bf96b88
SHA1 3496f9b943d53c957ed8481e3e2cd1ecc0decb4e
SHA256 3e05db9eae5443e2b629ae73496a7872602094fcf63d11eb5d99e63911c89d1e
SHA512 cabe3907ea165502d90b847642cbc4be99108b6eb18ad251f2acfe988131b2ed12fab8516e374c5e2a19b10c9df9c9ed3252cbffb7cd0c0fb9dcd258e2f4bb31

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000b

MD5 0128fb0696c3dd27adc2286988bf9042
SHA1 343db277048078eb9a12b76b8f482aae5d9e7ac2
SHA256 13bf19f7b084c49a6ef22dee10328411f4764e765209956bc1d01c8120cdacdb
SHA512 173b2bd5cdf252380286622fcb9ebd72c361788fcd00a04274dc330f7d20cc152cc29506bd5d03768518bab23053ec98c0ae522fe600987a479a15279d72acbd

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000c

MD5 201f988a9071a4a4a3d188bdecda38f5
SHA1 4ad903f73ee31f12b1c9e4c820439273cbc92727
SHA256 53c53364808c175a6038f9d0aae8fe3d1f5ce3cf87d5e9fa08f603d845633b37
SHA512 d9af07915a589ee48b08a1b8880d88d6215438292f4a227cbc809086c2dbd5735713c0929758359a8f3391dae746cd9b9de7885d5af560698a21be7d9f5bc025

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000d

MD5 516a9c398435f4e0e519d13091892fca
SHA1 c1a8a3747fed87cf8699c18b6f80f5369e207908
SHA256 de5c4e5ba7b850bbe5d35de5b20f4fd875be1f77ef73f7431172d1e0f6496dc6
SHA512 b79eab3e4abc5bd164d27f282a9913ad0c82bdbcb028be5137b77a429e6384e715d05a90014c23298152d2fe3ad2f90309ca028727ed9750cf29fd55b6d75302

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000e

MD5 4d0d60167bc23a412bcd8880d59e13d8
SHA1 cfbf2a6ed97ed0a30c571d2bbd6eb60731eaea27
SHA256 cd299b9251186ebf3bb0e928e4f710b3b542f0cde01bea6832cbada49138a85d
SHA512 6d56d41161bbe491a8f847ae3782e283a61d40d499d91fa6ef82ea845b347b8337b84e69024828dcbbf884b167afca67bdd67c7593a1a90950bab6fbdbb8eeba

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000f

MD5 b6438c9bc90d3e87381b574cdf17ae97
SHA1 86051ff3f018c1a475162597dab27079eef2ec7a
SHA256 a6db907a7ac399d7e920de4ac4b4a92808542039ba32dc6758637bffb413d56d
SHA512 c4d56c8880d5c27085cf64531d2620f84c950107fdda28986eb0bb4d2ce1b4a90f0d890b72f60b48ef2637b3dab7fd99ccf1f507c949ce5f66b52f756c3c6fe6

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000010

MD5 af693f9aea7dae36fb3bef4c9b6e56fb
SHA1 0d7896e2bb23f88e26e52b22a075350b354df447
SHA256 1717ea1fde8ceb7584341a24efc85c853083c660a1185968fbf94520f7193de2
SHA512 11cad7c40e29808104a9b84cfe2f4f1aa80f4ad06a07fd1379c64818fe869c6b6036af36f4dd3304e19b612141e9cf7b04e11c7a38a721ad03c067d9c07b266a

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000011

MD5 3c4b51f57a2ff4369261b845d84ca1ea
SHA1 3bb9a2f72d5fa0a9c4140ab74212d4cdd25fa323
SHA256 379bc709031d0e429a41012efd921210bcfd409ecaabe35257a3716032eb99a3
SHA512 81d0120f63e30cc5b31fc98af2caf75cd836defedf08a1918b019a4bd7fdc9746340ef81f7ead84299d6eceb3812a6edc79481344dd7ef19d7af572b1f2bac3d

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000012

MD5 5ce0a99458a2c7f2c0a6f3eb1a03d1d5
SHA1 6b3fdc4185f603a0948d2e8b7bc818763d7e2668
SHA256 6c5c0a29044c5aeec37211b18908acd0576b9dabc9d6fe95c8066cdc55146c0f
SHA512 5939d60a40f729b7ea19d6c9c1d264d7a174c6436748ea8c9619e7a20c1f1d4889f7e9b4cd017a889c985e9d2fd272e01d3e03d6b97325b2e8de5f3f9e1f2d67

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000013

MD5 107a4b9f1d95df5b969cced5c7248ded
SHA1 9341318acb76e81987277b335656f6d265066691
SHA256 295eac26825508b5f37f27c69b99d426582fe80752f636c69f1795be8f5d5ea4
SHA512 36c22b62a0377831b37ecc4f34b6912842bc57c2f9351548d1ba120ca2c9abaca709cd40046abc06d4b77694cbf1977b8f5d7ce899653f130ac697402e127857

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000014

MD5 7776d481997157e93d96f8589c3ae050
SHA1 13007e647ea91299b5aaaf7fc03a30bb65c38cd0
SHA256 74cd4d1f792e1200fd426048b53970c4eaeb5e5c1c789d034bffdff68167b3be
SHA512 12401e53282bcb20f6287f73b0d51c1c018cb0013df2d03e7d719eaa9e7fe952b9252c22445b67acdd78696f7b464045aed14f6e795922680fe733a0084a6217

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000015

MD5 112aef1f1740c497873762c576ba91ec
SHA1 63de6bd3e38f536213dddddb20c5cb61c232078f
SHA256 7f6a44eb7632c2cb6f990ede10a58c2cc3fb923bae1761f1be8e2a9ea3847b78
SHA512 9b3f9e5b4f911e0fc8404e89a68e308b14b4d2470d8358f95991d04abbc5ee04e3d93255deba720d3589f278938cf92710cc4f38f6b26c778d82d4680da89fbb

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000016

MD5 5a52b3c4658c45fa0d16f1b245cba28d
SHA1 1066afce3c4ca00ca7f61c628f6ba4a615b50c4f
SHA256 f148af9bffe215b1396117bb04aeb9f35fc82f346999a767a363198e9878ceae
SHA512 08ed56e8ef57a87bc84cc82355fbb9b5742a3a3218c5bf27369d2fc7d71d5c740af8c8830a85af3544ae5f2e96f59c9a0267a512a5c009c3e03683a3ef5f85bd

memory/2936-1065-0x00000000000F0000-0x0000000000102000-memory.dmp

memory/2936-1076-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1070-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1071-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1086-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1094-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1100-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1097-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1072-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1084-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1110-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1109-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1108-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1107-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1106-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1105-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1104-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1103-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1102-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1101-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1099-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1098-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1096-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1095-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1093-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1092-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1091-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1090-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1089-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1088-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1087-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1085-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1083-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1082-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1081-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1080-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1079-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1078-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1077-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1075-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1074-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1073-0x0000000074690000-0x0000000074842000-memory.dmp

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\index

MD5 a61db77e55430b847740ab5bb2cbc080
SHA1 95feedb04b2454343289919b6e8737be311f1d16
SHA256 943e7bf26f7a0b91ab14ab695c056b5d4de956ee75fec2ab805a04efe2b92da2
SHA512 1e19e58811490b59bff5c3a171b47863bec73b03f6033eeeb3ebc871f667fb6f8341ce667d4f3bc3091eec136af0e5a3e5e418606a8ecb3f8960e35466abb63d

memory/2936-1126-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1125-0x0000000075220000-0x0000000075247000-memory.dmp

memory/2936-1124-0x0000000074690000-0x0000000074842000-memory.dmp

memory/2936-1127-0x0000000000170000-0x0000000000171000-memory.dmp

memory/2352-1134-0x0000000000080000-0x0000000000092000-memory.dmp

memory/2936-1200-0x00000000751E0000-0x0000000075213000-memory.dmp

memory/2936-1199-0x0000000075220000-0x0000000075247000-memory.dmp

memory/2936-1198-0x0000000074690000-0x0000000074842000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe

MD5 455171a0d8585480d318102d13ca1faf
SHA1 16263b90994f2882ae03d8d190dca0df1204c0a2
SHA256 626953268197dacf5491197a3c4c60b4f2a14c3e878efb640eb48f34c9b23e31
SHA512 8961af0da23f63f5f4fa258bc6532e7ba95ffcdfed71ab813fa0715696b70452f4ef127ed08391edf22dd1fe01e38ee1921551ecba9bb5a79ef18d44ca16d11d

C:\Users\Admin\AppData\Local\Temp\nszE1D8.tmp\System.dll

MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

memory/1856-1307-0x0000000002C90000-0x0000000002ECD000-memory.dmp

memory/1856-1308-0x0000000002C90000-0x0000000002ECD000-memory.dmp

memory/3016-1326-0x000000000E760000-0x000000000E96C000-memory.dmp

memory/2840-1325-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3016-1324-0x000000000E760000-0x000000000E96C000-memory.dmp

memory/2840-1327-0x0000000002500000-0x000000000270C000-memory.dmp

memory/2840-1331-0x0000000002500000-0x000000000270C000-memory.dmp

memory/2840-1341-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3016-1345-0x000000000E8C0000-0x000000000EACC000-memory.dmp

memory/2092-1346-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2092-1364-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2292-1366-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3016-1365-0x000000000E760000-0x000000000E96C000-memory.dmp

memory/2292-1384-0x0000000000400000-0x000000000060C000-memory.dmp

memory/2140-1386-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3016-1385-0x000000000E8C0000-0x000000000EACC000-memory.dmp

memory/2140-1404-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3016-1407-0x000000000E760000-0x000000000E96C000-memory.dmp

memory/3016-1416-0x000000000E760000-0x000000000E96C000-memory.dmp

memory/3016-1419-0x000000000E8C0000-0x000000000EACC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-28 08:40

Reported

2024-11-28 08:42

Platform

win10v2004-20241007-en

Max time kernel

114s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\ C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
File created C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
File created C:\Program Files (x86)\GMInstaller\iWinLauncher.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
File created C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
File opened for modification C:\Program Files (x86)\GMInstaller\iWinLauncher.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nsm63B7.tmp\iWinInstallOptions.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\GMInstaller\ugm_installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\iWinArcade C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\iWinArcade\installRoot = "c:\\games\\Iplay Games" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@voV@ptL" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\UsukspKeKpsu = "pvUhE_BI_MLYjj|eR@BiP_i" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\Mundus: Impossible Universe\GameName = "Mundus: Impossible Universe" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649} \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vIWPoZqim = "^fYFQ_xD\\Gefm]qRQi\\]qh}XE^@~D@O{" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@vnJfkwl" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "Zpayhlhk\\" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQ@}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\yasmiqyps = "b_psjv`MMt\\ircvZkNU]`sn" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\yasmiqyps = "sueYtKEr^_UwaxhiO`[}e@J" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQD}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@veJOstX" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\flxxebybWr = "JgwnNjvfRmYyEpFNAMEOoNi@grPvbW@" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\yasmiqyps = "sueYtKEr^_UwaxhiO`[}e@J" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "ZpaskYxc`" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\eDlurRq = "CW\x7fAj}a|\\^^hETX{Bg" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\flxxebybWr = "JgwnNjvfRmYyEpFNAMEOoNi@grPvbW@" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "ZpatqAok|" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\UsukspKeKpsu = "pvUhE_BI_MLYjj|eR@BiP_i" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\yasmiqyps = "b_psjv`MMt\\ircvZkNU]`sn" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\YahooArcade C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQA}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQ\\}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eDlurRq = "SYn@SXEFwgdZ@\x7f_y\\J" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\flxxebybWr = "JiIckqQ^azzOIv|pQ]DO~EhTQhs`vKh" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eDlurRq = "SYn@SXEFwgdZ@\x7f_y\\J" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQC}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vIWPoZqim = "^fYFQ_HD\\Gefm]ARQi\\]qh}XE^@~D@O{" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\Mundus: Impossible Universe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\InprocServer32\Assembly = "mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\yasmiqyps = "sueYtKEr^_UwaxhiO`[}e@J" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\flxxebybWr = "JgwnNjvfRmYyEpFNAMEOoNi@grPvbW@" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\eDlurRq = "CW\x7fAj}a|\\^^hETX{Bg" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQF}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "ZparhEphh" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D} \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\bblQkU = "^Uks}lOMuUG\x7fEZXn_deJ`oWKRAPHY" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "Zpa\x7f\x7f^iax" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\yasmiqyps = "b_psjv`MMt\\ircvZkNU]`sn" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQJ}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQK}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@vhLXg|P" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\bblQkU = "UdfVmIMGhfVixz`ZgjNMEmh`jjgdJ" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\flxxebybWr = "JiIckqQ^azzOIv|pQ]DO~EhTQhs`vKh" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\InprocServer32\Class = "System.Text.DecoderReplacementFallback" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\UsukspKeKpsu = "Xl\x7fluxSUVHeao@kUVxH_Tcg" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQE}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\eDlurRq = "SYn@SXEFwgdZ@\x7f_y\\J" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\Mundus: Impossible Universe\InstallDir = "c:\\games\\Iplay Games\\Mundus Impossible Universe" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscoree.dll" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\vwvmrcWazwv = "gdH]ETV|EEQSJdv~]`eG}b}}\\uQI}Q" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "ZpawSF~cH" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\vIWPoZqim = "BKqq_AMzo~]]t^]`pl_\x7fWUf\\}Lc{GACE" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\vwvmrcWazwv = "luvcl_EUIFL\x7funTYrvIiKQA^a\\_{hN" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@vdVihwx" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\vwvmrcWazwv = "luvcl_EUIFL\x7funTYrvIiKQA^a\\_xhN" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade\7971117617474095322 = "Mundus: Impossible Universe" C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@v`nvnwP" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\UsukspKeKpsu = "Xl\x7fluxSUVHeao@kUVxH_Tcg" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "ZpaywV{ct" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{092DA472-63F8-AA70-689C-09E4D4B76B6D}\NbdZJXpAgVQ = "Zpaqsw]lD" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\{1E77B12B-AF5C-13D1-B2E4-0060975B8649}\NbdZJXpAgVQ = "o@vfNGMx\\" \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 220 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe
PID 220 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe
PID 220 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe
PID 4884 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 4884 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 4884 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe
PID 3964 wrote to memory of 1088 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 3964 wrote to memory of 1088 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 3964 wrote to memory of 1088 N/A C:\Program Files (x86)\GMInstaller\ugm_installer.exe C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe
PID 1088 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 1088 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 1088 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 1088 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 1088 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 1088 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe
PID 1088 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 1088 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 1088 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe
PID 2672 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2672 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2672 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe
PID 2672 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 2672 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 2672 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe
PID 2436 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsm63B7.tmp\iWinInstallOptions.exe
PID 2436 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsm63B7.tmp\iWinInstallOptions.exe
PID 2436 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe C:\Users\Admin\AppData\Local\Temp\nsm63B7.tmp\iWinInstallOptions.exe
PID 1088 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe
PID 1088 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe \??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe

"C:\Users\Admin\AppData\Local\Temp\2818cfc99080bef29e9ec542c819c5bedd5e29493a1bd6a681d9d411f2d9c9da.exe"

C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\GamesManagerInstaller.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest="PF/7971117617474095322/7971117605521780774/13/0"

C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe

"C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe" -gmregchannelid=110341560

C:\Program Files (x86)\GMInstaller\ugm_installer.exe

"C:\Program Files (x86)\GMInstaller\ugm_installer.exe" -installer.createiwinshortcuts=yes -config.channel=110341560 -config.uri=http://gm/iwin/index.html -config.channelName=Iplay -config.iwinrequest="PF/7971117617474095322/7971117605521780774/13/0"

C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe

"C:\Users\Admin\AppData\Local\GamesManager\GamesManager.exe" -config.uri=http://gm/iwin/index.html -config.channel="110341560" -config.iwinrequest="PF/7971117617474095322/7971117605521780774/13/0"

C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe

"C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=renderer --enable-logging --log-level=2 --no-sandbox --user-agent="NextDM/2.16.2.1015 AppleWebKit/535.19 (KHTML, like Gecko) GamesManager/2.16.2.1015 110341560 WinVer/6.2 [x64]" --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" --lang --channel=1088.02772C80.2039224878 /prefetch:3

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x33c 0x338

C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe

"C:\Users\Admin\AppData\Local\GamesManager\awesomium_process.exe" --type=gpu-process --channel=1088.028006E0.1351053972 --enable-logging --log-level=2 --no-sandbox --awesomium-log-path="C:\Users\Admin\AppData\Local\GamesManager\./awesomium.log" /prefetch:12

C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe

"C:\Users\Admin\AppData\Local\GamesManager\iWinInstaller.exe" -gmregcopysrc="HKEY_LOCAL_MACHINE\Software\iWinArcade" -gmregcopydest="HKEY_CURRENT_USER\Software\IplayArcade" -gmregcopylocalmachinedest="HKEY_LOCAL_MACHINE\Software\IplayArcade" -gmregisiwin=true -gmchannelcode=110341560 -game.sku="7971117617474095322" -game.name="Mundus: Impossible Universe" -gmregcopyvirtual=HKU\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\IplayArcade -gmreg="Software\IplayArcade" -gmexe="IplayGames.exe" -gmregkey="Install_Dir" -installer="C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe" -preinstallurl="http://gm-iplay.iwin.com/dl/preinstall-options.exe" -gamestring=7971117617474095322 -config.installRoot="c:\games\Iplay Games" -gmInstallRootRegKey="HKEY_CURRENT_USER\Software\iWinArcade\installRoot"

C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe

"C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe" -gamestring=7971117617474095322 /S

C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe

"C:\Users\Admin\AppData\Local\GamesManager\110341560\downloads\7971117617474095322.exe" /S

C:\Users\Admin\AppData\Local\Temp\nsm63B7.tmp\iWinInstallOptions.exe

"C:\Users\Admin\AppData\Local\Temp\nsm63B7.tmp\iWinInstallOptions.exe" /S

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

\??\c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe

"c:\games\Iplay Games\Mundus Impossible Universe\GLWorker.exe" ALTUSERNAME;DAYSLEFT;TIMELEFTTOTAL;gid7971117617474095322

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.iwin.com udp
NL 18.239.69.43:80 dl.iwin.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 43.69.239.18.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 static.iwincdn.com udp
FR 68.232.35.54:80 static.iwincdn.com tcp
US 8.8.8.8:53 54.35.232.68.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 gm-iplay.iwin.com udp
US 54.227.242.142:80 gm-iplay.iwin.com tcp
US 54.227.242.142:80 gm-iplay.iwin.com tcp
US 54.227.242.142:80 gm-iplay.iwin.com tcp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 fea.iwincdn.com udp
FR 68.232.35.54:80 fea.iwincdn.com tcp
US 8.8.8.8:53 cimg.iwin.com udp
US 8.8.8.8:53 ws-iplay.iwin.com udp
US 52.22.60.172:80 ws-iplay.iwin.com tcp
IE 3.162.140.81:80 cimg.iwin.com tcp
US 8.8.8.8:53 download.iwincdn.com udp
GB 172.217.169.40:80 www.googletagmanager.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
PL 93.184.221.131:80 download.iwincdn.com tcp
US 8.8.8.8:53 81.140.162.3.in-addr.arpa udp
US 8.8.8.8:53 172.60.22.52.in-addr.arpa udp
US 8.8.8.8:53 142.242.227.54.in-addr.arpa udp
US 8.8.8.8:53 40.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 131.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.200.3:80 o.pki.goog tcp
US 54.227.242.142:80 ws-iplay.iwin.com tcp
US 8.8.8.8:53 dl.iwin.com udp
NL 18.239.69.13:80 dl.iwin.com tcp
US 8.8.8.8:53 13.69.239.18.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Users\Admin\AppData\Local\Temp\nsm591D.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

C:\Users\Admin\AppData\Local\Temp\nse850F.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

C:\Program Files (x86)\GMInstaller\iWinUpgrader.exe

MD5 3d72f38357f46715e675e074d59fc7a9
SHA1 2cf2f0d655fbbff941ae3d5c1e911096fec5bd12
SHA256 86cb79cb393ccbebd65e137cf509f09e0cabaecb93a2d21369488002712af118
SHA512 35f5e1f19490814db7bb041588ed9f6c99a04cdb485c19fbae3e96e59da003c345aa835fe482e904c73577f37eba6f47982dc4ba5d3b5a58396b794830639006

C:\Users\Admin\AppData\Local\Temp\nse850F.tmp\StdUtils.dll

MD5 c291f96471927e7bc49398b0de7168dd
SHA1 eda478005d69ee86126a8378de5007b139e20a5d
SHA256 c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6
SHA512 b4244615e99617d437d3120f201ca88c7ab4a6b4b84e7f0c3b4495a0fe8c979e04feaa08f11ad14fa92f002a3a521422221132ff54a081ef1c6bcbdf09d5929d

C:\Users\Admin\AppData\Local\Temp\nsxA589.tmp\System.dll

MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

C:\Users\Admin\AppData\Local\GamesManager\110402287\cdata.dat

MD5 11e4b4414b6271b8f8c45511f97d4e5a
SHA1 65ee25560144d22bf7f8bce3b8742a856a8ee6d1
SHA256 db67ca3cf89a6fccd13aa21207e279c3fd3c7bcaf181c65ecfc18cf2da289eb3
SHA512 68e8bce33cfc588f800f486f51c8a1e27b12e58af336946102d61a451341eee875b4cbb2a4203f3cade174b21f9e74cd82d15988abb107564c87c2e3bd088c58

memory/1088-916-0x0000000000580000-0x0000000000592000-memory.dmp

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000004

MD5 7fd8ffea25728006bfddf7e6c7c122cd
SHA1 e3049e9f8a643b8b2cfd2ca5e6ab8bfd483efe99
SHA256 0a6c4c4db171663b9b1c533a4dd6938e22cb4d5b9607d0ca92a20c1354018b49
SHA512 477467568f8c24772fd83680db1e9750c7e377cb706c0fa734e9c8b1bc847cf9a60f4be444044bdbfa4cdb9cb4352f86edd1ea70bdcd86a20b361f9acb2cd58f

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000007

MD5 962bf963a37a6d84fe7fb552763dc094
SHA1 cac681467dac917122dd9b57bd9a78781549a523
SHA256 2f49797d196f00bb331663ac1564c775d65ed1bfb508aec9e4c3b6fc89bb4dc0
SHA512 e378da6a0d29f91eb5a0de3876fda0cc1b5a6e6632f5ddf0d45fcc909084aad70bd99b97a29df15d271593701bd77a92766a1f091540dc3cdf699c9d831b6192

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000006

MD5 032f7a630c11189923cae95fb0fa6892
SHA1 74dddaa937b077fb98b584b20e1a3e3ad1bee422
SHA256 b0b84f6aca649b3b9131799ed0983e03b113497df4f33e30a3389ee1b34687ee
SHA512 e24c5a9dfd1f6fcd07dea0b3723a0794fe27042c2f52d0b869e8224ed0a442e73e24d265103ba2f11783b8c408f9724ba11ef76a1e3330ee3b78156ebad406bf

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000005

MD5 8c81fab58b8ed37b527b16a37a8065c3
SHA1 5d3d58f8833d9975d6dd5e7153b22a936f2f76bd
SHA256 74d4acb9d62968980f8a096977e3bf42c1ccffb0c7501a7fff1a0ba589b56bd7
SHA512 e99c9eae7718c4154bc2895431261e1ac3cafda565d85474876be004063742d84af1c20f970dd1f30c9c5acbb00d3e7357f7a13376730cbd987a24dcc4086699

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000003

MD5 a959af924d21c7b788fe197caf03fc40
SHA1 21733827a5501133619b8ac4533201267d1afa3f
SHA256 4d191ea72953f5806161c3c16ae8e4bb629b47156481bd074acfa5db08000016
SHA512 1fa28a7fe716b328fc43b3e8993875977a2e9f39fd02dfce313d27021403ddfaf7f19c7607bf1350c4c2f05a38170d3621ed33cc60f8b38fb9d1dbda63b120e7

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000002

MD5 ae0a675e3e15e28aab8246028df16236
SHA1 772b2587aa2fa345fb760eff9ebe5acd97937243
SHA256 49f14bad610f40f0ae76a33c55ef89a1e694219bab49b1b99cb53d754774c0fc
SHA512 21723efa6aaa2fa599b42c1480c380c24f9aaf14755e82e88054e80713454408bfb047ba77d921d71573d2319f14f134938f3401aa3b92b756670b7c99892caa

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000001

MD5 e2ff9e87912d08576c7f26a8014b2525
SHA1 026136afd27657e7edead2f12310275af249caac
SHA256 5e663896f40416a2d5f159e0433dbc9019dbe9d05abb34c1f3a5b38a88b5c03a
SHA512 7b4dfe37205909f2f14669c965821a91daba8be383ce83d119fde5d290bc938eeaf0c70e9d27998f00dc6cdca0d0c0b1b2bbdc13ac2662fc4e766919e092e1d9

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000008

MD5 5cc4154e0c0dac8dfeea73c07ccdc83e
SHA1 5d2d995d51b8855d1e1e43b85d8b5a9d22b796ad
SHA256 12d5f1be9a764164f4cc6e7dda726c4ea3d19ea79382d28c75b0dea862608968
SHA512 1112959cfecc25efae799b566dff24f7bfafc60ddd8974ce0cdd653ee834a57090d9f78e2773ad9a826e0ba6e1487c49e1ef957c34385c262914f09ea8b26157

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000009

MD5 b41c0b75a60eab42145e9d0b17408b0b
SHA1 0f3151c6c22834079b55fcea9d873c0184b3fd7c
SHA256 209dc679252feca2725cafb6e8fc314f2618bd748db846be6b4e0ca71c55a330
SHA512 f728be6cb869a6279a6ba1d85865c510c6f9905a04226a25965b7b5eb0feadbaf4364f4508b08292eb597b2a9fe14af4e6fa8a9eb56f4e704108dc09e862edbe

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000a

MD5 4e5d5ff08a7703b746695ec19bf96b88
SHA1 3496f9b943d53c957ed8481e3e2cd1ecc0decb4e
SHA256 3e05db9eae5443e2b629ae73496a7872602094fcf63d11eb5d99e63911c89d1e
SHA512 cabe3907ea165502d90b847642cbc4be99108b6eb18ad251f2acfe988131b2ed12fab8516e374c5e2a19b10c9df9c9ed3252cbffb7cd0c0fb9dcd258e2f4bb31

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000b

MD5 0128fb0696c3dd27adc2286988bf9042
SHA1 343db277048078eb9a12b76b8f482aae5d9e7ac2
SHA256 13bf19f7b084c49a6ef22dee10328411f4764e765209956bc1d01c8120cdacdb
SHA512 173b2bd5cdf252380286622fcb9ebd72c361788fcd00a04274dc330f7d20cc152cc29506bd5d03768518bab23053ec98c0ae522fe600987a479a15279d72acbd

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000d

MD5 516a9c398435f4e0e519d13091892fca
SHA1 c1a8a3747fed87cf8699c18b6f80f5369e207908
SHA256 de5c4e5ba7b850bbe5d35de5b20f4fd875be1f77ef73f7431172d1e0f6496dc6
SHA512 b79eab3e4abc5bd164d27f282a9913ad0c82bdbcb028be5137b77a429e6384e715d05a90014c23298152d2fe3ad2f90309ca028727ed9750cf29fd55b6d75302

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000e

MD5 4d0d60167bc23a412bcd8880d59e13d8
SHA1 cfbf2a6ed97ed0a30c571d2bbd6eb60731eaea27
SHA256 cd299b9251186ebf3bb0e928e4f710b3b542f0cde01bea6832cbada49138a85d
SHA512 6d56d41161bbe491a8f847ae3782e283a61d40d499d91fa6ef82ea845b347b8337b84e69024828dcbbf884b167afca67bdd67c7593a1a90950bab6fbdbb8eeba

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000010

MD5 af693f9aea7dae36fb3bef4c9b6e56fb
SHA1 0d7896e2bb23f88e26e52b22a075350b354df447
SHA256 1717ea1fde8ceb7584341a24efc85c853083c660a1185968fbf94520f7193de2
SHA512 11cad7c40e29808104a9b84cfe2f4f1aa80f4ad06a07fd1379c64818fe869c6b6036af36f4dd3304e19b612141e9cf7b04e11c7a38a721ad03c067d9c07b266a

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000f

MD5 b6438c9bc90d3e87381b574cdf17ae97
SHA1 86051ff3f018c1a475162597dab27079eef2ec7a
SHA256 a6db907a7ac399d7e920de4ac4b4a92808542039ba32dc6758637bffb413d56d
SHA512 c4d56c8880d5c27085cf64531d2620f84c950107fdda28986eb0bb4d2ce1b4a90f0d890b72f60b48ef2637b3dab7fd99ccf1f507c949ce5f66b52f756c3c6fe6

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_00000c

MD5 201f988a9071a4a4a3d188bdecda38f5
SHA1 4ad903f73ee31f12b1c9e4c820439273cbc92727
SHA256 53c53364808c175a6038f9d0aae8fe3d1f5ce3cf87d5e9fa08f603d845633b37
SHA512 d9af07915a589ee48b08a1b8880d88d6215438292f4a227cbc809086c2dbd5735713c0929758359a8f3391dae746cd9b9de7885d5af560698a21be7d9f5bc025

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000011

MD5 3c4b51f57a2ff4369261b845d84ca1ea
SHA1 3bb9a2f72d5fa0a9c4140ab74212d4cdd25fa323
SHA256 379bc709031d0e429a41012efd921210bcfd409ecaabe35257a3716032eb99a3
SHA512 81d0120f63e30cc5b31fc98af2caf75cd836defedf08a1918b019a4bd7fdc9746340ef81f7ead84299d6eceb3812a6edc79481344dd7ef19d7af572b1f2bac3d

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000012

MD5 5ce0a99458a2c7f2c0a6f3eb1a03d1d5
SHA1 6b3fdc4185f603a0948d2e8b7bc818763d7e2668
SHA256 6c5c0a29044c5aeec37211b18908acd0576b9dabc9d6fe95c8066cdc55146c0f
SHA512 5939d60a40f729b7ea19d6c9c1d264d7a174c6436748ea8c9619e7a20c1f1d4889f7e9b4cd017a889c985e9d2fd272e01d3e03d6b97325b2e8de5f3f9e1f2d67

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000013

MD5 107a4b9f1d95df5b969cced5c7248ded
SHA1 9341318acb76e81987277b335656f6d265066691
SHA256 295eac26825508b5f37f27c69b99d426582fe80752f636c69f1795be8f5d5ea4
SHA512 36c22b62a0377831b37ecc4f34b6912842bc57c2f9351548d1ba120ca2c9abaca709cd40046abc06d4b77694cbf1977b8f5d7ce899653f130ac697402e127857

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000016

MD5 5a52b3c4658c45fa0d16f1b245cba28d
SHA1 1066afce3c4ca00ca7f61c628f6ba4a615b50c4f
SHA256 f148af9bffe215b1396117bb04aeb9f35fc82f346999a767a363198e9878ceae
SHA512 08ed56e8ef57a87bc84cc82355fbb9b5742a3a3218c5bf27369d2fc7d71d5c740af8c8830a85af3544ae5f2e96f59c9a0267a512a5c009c3e03683a3ef5f85bd

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000015

MD5 112aef1f1740c497873762c576ba91ec
SHA1 63de6bd3e38f536213dddddb20c5cb61c232078f
SHA256 7f6a44eb7632c2cb6f990ede10a58c2cc3fb923bae1761f1be8e2a9ea3847b78
SHA512 9b3f9e5b4f911e0fc8404e89a68e308b14b4d2470d8358f95991d04abbc5ee04e3d93255deba720d3589f278938cf92710cc4f38f6b26c778d82d4680da89fbb

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\AppCache\Cache\f_000014

MD5 7776d481997157e93d96f8589c3ae050
SHA1 13007e647ea91299b5aaaf7fc03a30bb65c38cd0
SHA256 74cd4d1f792e1200fd426048b53970c4eaeb5e5c1c789d034bffdff68167b3be
SHA512 12401e53282bcb20f6287f73b0d51c1c018cb0013df2d03e7d719eaa9e7fe952b9252c22445b67acdd78696f7b464045aed14f6e795922680fe733a0084a6217

memory/4376-1055-0x0000000000890000-0x00000000008A2000-memory.dmp

memory/4376-1089-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1092-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1100-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1099-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1098-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1097-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1096-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1095-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1094-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1093-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1091-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1090-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1088-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1087-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1086-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1084-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1083-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1081-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1079-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1078-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1076-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1075-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1074-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1073-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1072-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1071-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1069-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1068-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1067-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1066-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1065-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1064-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1063-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1061-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1085-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1082-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1080-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1077-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1070-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1062-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1060-0x0000000072190000-0x0000000072342000-memory.dmp

C:\Users\Admin\AppData\Local\GamesManager\110341560\webdata\Cache\index

MD5 9bf575bcc94beb8f3da34101cdecf7ea
SHA1 57282ec670d6036033371d1e360b52a8bea2c7dc
SHA256 44b2f3ac069879c64561f4ae8cd526a8771dc4dc89083206ba92d52d8527ca37
SHA512 9036391a45aba9dd3c3e4ba02eda193b26923e7406c9916ea1a72c307c7f515bde45d4bddc8e3c37a6978c1753e0c0481da0a4e0806106a626b98927dad37296

memory/4376-1116-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1115-0x0000000074CA0000-0x0000000074CC7000-memory.dmp

memory/4376-1114-0x0000000072190000-0x0000000072342000-memory.dmp

memory/4376-1117-0x0000000002D00000-0x0000000002D01000-memory.dmp

memory/4376-1183-0x0000000074310000-0x0000000074343000-memory.dmp

memory/4376-1182-0x0000000074CA0000-0x0000000074CC7000-memory.dmp

memory/4376-1181-0x0000000072190000-0x0000000072342000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\preinstall-options.exe

MD5 455171a0d8585480d318102d13ca1faf
SHA1 16263b90994f2882ae03d8d190dca0df1204c0a2
SHA256 626953268197dacf5491197a3c4c60b4f2a14c3e878efb640eb48f34c9b23e31
SHA512 8961af0da23f63f5f4fa258bc6532e7ba95ffcdfed71ab813fa0715696b70452f4ef127ed08391edf22dd1fe01e38ee1921551ecba9bb5a79ef18d44ca16d11d

C:\Users\Admin\AppData\Local\Temp\nsr6202.tmp\System.dll

MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

memory/1680-1307-0x0000000000400000-0x000000000060C000-memory.dmp

memory/1680-1309-0x0000000002AA0000-0x0000000002CAC000-memory.dmp

memory/1680-1313-0x0000000002AA0000-0x0000000002CAC000-memory.dmp

memory/1680-1317-0x0000000000400000-0x000000000060C000-memory.dmp

memory/1680-1316-0x0000000000400000-0x000000000060C000-memory.dmp

memory/1680-1323-0x0000000000400000-0x000000000060C000-memory.dmp

memory/4820-1342-0x0000000000400000-0x000000000060C000-memory.dmp

memory/844-1361-0x0000000000400000-0x000000000060C000-memory.dmp

memory/3492-1383-0x0000000000400000-0x000000000060C000-memory.dmp